Privacy Policy

Softmentum ("we," "our," or "us") provides the Softmentum Parent App, a mobile application for Android and iOS that enables parents and legal guardians to monitor their child's academic progress, attendance, fees, homework, timetable, and related information at schools and colleges using the Softmentum Education ERP platform ("Platform").

This Privacy Policy ("Policy") explains:

• What personal information we collect about you and your child through the App
• Why we collect it and how we use it
• How we store, protect, and share it
• Your rights regarding your personal information
• How to contact us with questions or to exercise your rights

The school or college ("Institution") through which your account is created also processes student academic records and may have its own data protection policies. We encourage you to review your Institution's policies.

This Policy should be read alongside the general Softmentum Platform Privacy Policy, which covers the broader ERP platform used by Institutions.

The App is provided by Softmentum, a technology company operating the Softmentum Education ERP platform at softmentum.com.

Softmentum plays a dual role:

• Data fiduciary for information you provide directly — such as your login credentials, messages, and leave requests
• Data processor acting on behalf of the Institution (which is the data fiduciary) for student academic records such as attendance, marks, fees, and timetable data

For questions about specific student academic records, you may need to contact your Institution directly, as it controls those records.

We use your information for the following purposes:

• Verifying your identity using your mobile number and password
• Confirming that your account is linked to an authorised student as established by the Institution
• Displaying academic, attendance, fee, homework, timetable, transport, and examination information for your linked student
• Sending push notifications for attendance absences, fee reminders, payment confirmations, homework assignments, result announcements, and school announcements
• Processing fee payments through our payment gateway partner, Razorpay
• Enabling in-app messaging between parents and school staff
• Processing and routing leave applications to the school
• Managing and securing your account password
• Registering your device to enable push notifications
• Detecting and preventing unauthorised access and fraudulent activity
• Meeting applicable legal and regulatory obligations

The App is designed exclusively for use by parents, legal guardians, and authorised institution-linked adults — not by students directly.

• Student data is displayed only after successful authentication and confirmation of an Institution-created parent-student link
• Parents and guardians should only use the App for students for whom they hold lawful parental or guardian authority
• You must not share your login credentials or the student data displayed in the App with unauthorised persons
• Softmentum and participating Institutions handle student data, particularly data relating to minor children, with additional care and sensitivity
• Student data is not used for commercial advertising, profiling unrelated to education, or any purpose beyond the legitimate educational and administrative needs of the Institution
• Where a student is under 18 years of age, the App account is held and operated by the parent or guardian, not the child

We process your personal information on the following legal grounds:

• Consent: By installing and registering for the App, you consent to the collection and use of your personal information as described in this Policy
• Contractual necessity:Your login credentials, push token, and session data are required to provide the App's authentication and notification services
• Legitimate interests: Server access logs and security monitoring are maintained to protect users and ensure service security and reliability
• Legal obligation: Certain data may be processed or retained to comply with applicable Indian laws
• Institutional mandate: Student academic records are processed at the direction of the Institution in the course of its lawful educational and administrative activities

We share your information only when necessary for the following purposes:

Fee payments in the App are processed through Razorpay, a payment aggregator regulated by the Reserve Bank of India (RBI) and compliant with PCI-DSS (Payment Card Industry Data Security Standard).

When you make a fee payment:

• You are directed to Razorpay's secure payment interface
• Razorpay collects and processes your card, UPI, net-banking, or wallet credentials directly
• Softmentum does not receive, transmit, or store your complete card number, UPI PIN, CVV, or internet-banking password

Softmentum retains the following payment data:

• Razorpay order ID and payment ID (reference identifiers)
• Payment amount, currency, and method type
• Transaction status
• Receipt number and related student fee record

This data is retained for financial reconciliation and as required under Indian accounting and GST laws. Razorpay's own privacy policy governs how Razorpay handles your payment credentials.

The App requests only the following device permissions. No other permissions — such as location, microphone, contacts, calendar, or biometric authentication — are requested.

We use reasonable administrative, technical, and organisational safeguards to protect your personal information, including:

• HTTPS / TLS encryption — all data transmitted between the App and our servers uses encrypted connections
• Password hashing — passwords are stored as one-way bcrypt hashes with a unique salt; plaintext passwords are never stored or logged
• Secure token storage — your authentication token is stored using expo-secure-store, which uses the iOS Keychain and Android Keystore (device-level secure enclaves)
• Token expiration — authentication tokens expire after 30 days and are invalidated immediately on logout
• Login rate limiting — login attempts are rate-limited to reduce the risk of brute-force attacks
• School-wise data isolation — your session is cryptographically bound to your Institution; every API endpoint verifies this association before returning data
• Role-based access control — the API verifies your identity and parent-student link before returning any student information
• Access logging — API access is logged for security and diagnostic purposes

Softmentum serves many schools and colleges on a shared technology platform. Each parent account is associated with a specific Institution, identified by a unique school code.

• Your authentication token encodes your Institution identifier; you can only access data belonging to your school
• Every API endpoint verifies that you are authenticated and that the requested data belongs to your Institution and your linked student
• Data belonging to one Institution is not intentionally made accessible to users of a different Institution

If you believe you have inadvertently accessed data belonging to another Institution or student, please report it immediately to support@softmentum.com.

We retain your personal information for the following periods:

• Account credentials — while your account remains active with the Institution
• Push notification tokens — while the device registration is active; deregistered when you log out or the token becomes invalid
• Leave requests and parent-staff messages — at the direction of the Institution for its institutional and legal record-keeping requirements
• Payment references (Razorpay order ID, payment ID, amount, receipt) — for financial reconciliation; typically 7 years as required under Indian accounting and GST laws
• Server access logs — for security and diagnostic purposes for a limited period
• Authentication tokens — expire after 30 days; invalidated immediately on logout

When an Institution ceases to use the Platform, personal data is handled in accordance with the data retention terms agreed between Softmentum and that Institution.

You may request deletion of your Parent App account and associated personal data at any time.

Deleting the App from your device does not delete your account data. Deletion from the Parent App does not remove records held independently by the Institution's own systems; contact your Institution for deletion of those records.

Under India's Digital Personal Data Protection Act, 2023 and other applicable Indian data protection laws, you have the following rights:

• Right to Access: Request a summary of the personal data we hold about you
• Right to Correction: Request that inaccurate or incomplete data be corrected
• Right to Erasure: Request deletion of your personal data (see Section 13)
• Right to Withdraw Consent: Withdraw consent for processing based on consent, subject to operational and legal requirements
• Right to Grievance Redressal: Raise a complaint with our Grievance Officer (see Section 20) or with the Data Protection Board of India
• Right to Nominate: Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity

For student academic records controlled by the Institution, please contact your school or college directly.

To exercise any right: email support@softmentum.com with the subject line "Data Rights Request".

Our backend infrastructure may be hosted by cloud providers whose data centres are located in India or in other countries. Where personal information is processed or stored outside India, we take reasonable steps to ensure that appropriate safeguards are in place, consistent with India's Digital Personal Data Protection Act, 2023.

Expo's push notification infrastructure and Razorpay's payment processing systems transfer and process data in accordance with their own data residency and cross-border transfer commitments.

Subject to your device notification settings, the App may send you the following types of push notifications:

• Attendance alerts — when your linked student is marked absent
• Fee payment reminders — for outstanding or upcoming fee dues
• Payment confirmations — after a successful fee payment
• Homework updates — new assignments or submission deadlines
• Examination announcements and result notifications
• School and Institution announcements
• Account security messages

Managing notifications:You can disable optional push notifications at any time through your device's Settings > Notifications > Softmentum. Essential account security messages may still be delivered where necessary for service continuity.

The Softmentum website at softmentum.com uses cookies, including analytics cookies, as described in the general Softmentum Privacy Policy.

The Softmentum Parent App itself does not use browser cookies. Your authentication token and session data are stored using expo-secure-store, which uses the iOS Keychain and Android Keystore — not browser cookies or web storage. This data is stored locally on your device and is used only to maintain your authenticated session.

When the App opens the Razorpay payment interface as a web view or browser page, Razorpay may use its own cookies or web storage. Please review Razorpay's privacy and cookie policies for details.

The App may include links to or open interfaces provided by:

• Your Institution's own website or online resources
• Razorpay's payment interface
• External educational or informational resources shared by the Institution

These third-party services operate under their own privacy policies and terms of service. Softmentum is not responsible for the privacy practices or content of external services. We encourage you to review the privacy policies of any third-party services you access.

We may update this Privacy Policy from time to time to reflect changes in the App, our practices, or applicable law. Material changes will be communicated through:

• A notice within the App or a push notification to registered devices
• An updated notice at softmentum.com/parent-app/privacy-policy

The "Last Updated" date at the top of this page will reflect when the most recent changes were made. Continued use of the App after the effective date of changes constitutes acceptance of the updated Policy. If you object to any change, you may request account deletion as described in Section 13.